[Pkg-xfce-devel] Bug#763067: Licensing issue on images files

[Clément Hermann (nodens)]

Package: xfce4-power-manager-data
Version: 1.2.0-5
Severity: important

Hi,

while preparing my packaging of Tails' OpenPGP Applet (ITP #756404), it was
pointed to me that there were issues on images files shipped with it : they
where licensed using CC-BY-SA 2.0, which is not DFSG-compliant. They seemed
indeed derived from icons using an old tango theme, which were indeed licensed
CC-BY-SA 2.0 at the time.

I saw that on my Sid system, several packages have the same issue :

~$ rgrep -rl 'by-sa/2\.0' /usr/share/icons/*/scalable |xargs dlocate --package-only
gitg
network-manager-gnome
soundconverter
thunar-volman
xfburn
xfce4-battery-plugin
xfce4-fsguard-plugin
xfce4-power-manager-data

There may be more, since it only reports the packages I have installed.
It doesn't seem to be dual-licensing, judging from the content of the svg files
involved.

So, I asked on debian-devel but received very few responses, mostly
inconclusives or saying we should allow CC-BY-SA 2.0 in debian [1] [2]

This is not an issue in the package I work on anymore, since I could remake the
icons and include them upstream. However, I think it's best to track this issue
and maybe clarify once and for all what to do with CC-BY-SA 2.0 images.

Currently, I see the following options : 
- convincing upstream to relicense the files using a later (>= 3.0) version of the license, which, as I found out, can be difficult
- removing or replacing the files
- decide that CC-BY-SA 2.0 is OK after all.

Cheers,

[1] https://lists.debian.org/debian-devel/2014/08/msg00073.html
[2] https://lists.debian.org/debian-devel/2014/09/msg00725.html

-- 
Clement Hermann (nodens)

-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

xfce4-power-manager-data depends on no packages.

Versions of packages xfce4-power-manager-data recommends:
ii  librsvg2-common      2.40.4-1
ii  xfce4-power-manager  1.2.0-5

xfce4-power-manager-data suggests no packages.

-- no debconf information